Parent

Methods

Class/Module Index [+]

Quicksearch

Rex::Registry::ValueKey

Attributes

data_offset[RW]
full_path[RW]
length_of_data[RW]
name[RW]
name_length[RW]
readable_value_type[RW]
value[RW]
value_type[RW]

Public Class Methods

new(hive, offset) click to toggle source
# File lib/rex/registry/valuekey.rb, line 9
def initialize(hive, offset)
        offset = offset + 4

        vk_header = hive[offset, 2]

        if vk_header !~ /vk/
                puts "no vk at offset #{offset}"
                return
        end

        @name_length = hive[offset+0x02, 2].unpack('c').first
        @length_of_data = hive[offset+0x04, 4].unpack('l').first
        @data_offset = hive[offset+ 0x08, 4].unpack('l').first
        @value_type = hive[offset+0x0C, 4].unpack('c').first

        if @value_type == 1
                @readable_value_type = "Unicode character string"
        elsif @value_type == 2
                @readable_value_type = "Unicode string with %VAR% expanding"
        elsif @value_type == 3
                @readable_value_type = "Raw binary value"
        elsif @value_type == 4
                @readable_value_type = "Dword"
        elsif @value_type == 7
                @readable_value_type = "Multiple unicode strings separated with '\\x00'"
        end

        flag = hive[offset+0x10, 2].unpack('c').first

        if flag == 0
                @name = "Default"
        else
                @name = hive[offset+0x14, @name_length].to_s
        end

        @value = ValueKeyData.new(hive, @data_offset, @length_of_data, @value_type, offset)
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.